Invision Power Board BBCode处理HTML注入漏洞

BUGTRAQ ID: 27920 Invision Power Board是一个非常流行的PHP论坛程序。 IPB处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞攻击其他Web用户。 IPB没有正确地过滤通过自定义BBCode所传送的输入，如果用户向论坛提交了恶意请求的话，就可能导致注入任意HTML和脚本代码，当用户浏览张贴时就会在浏览器会话中执行这些代码。 Invision PS IPB 2.3.4 厂商补丁： Invision PS ----------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Cross site scripting

Cross-site scripting XSS vulnerability in Tor World Tor Search 1.1 and earlier, I-Navigator 4.0, Mobile Frontier 2.1 and earlier, Diary.cgi aka Quotes of the Day 1.5 and earlier, Tor News 1.21 and earlier, Simple BBS 1.3 and earlier, Interactive BBS 1.3 and earlier, Tor Board 1.1 and earlier,...

Cross site scripting

Cross-site scripting XSS vulnerability in Invision Power Board IPB or IP.Board 2.3.4 allows remote attackers to inject arbitrary web script or HTML via crafted BBCodes in an unspecified context...

CVE-2008-0917

Cross-site scripting XSS vulnerability in Tor World Tor Search 1.1 and earlier, I-Navigator 4.0, Mobile Frontier 2.1 and earlier, Diary.cgi aka Quotes of the Day 1.5 and earlier, Tor News 1.21 and earlier, Simple BBS 1.3 and earlier, Interactive BBS 1.3 and earlier, Tor Board 1.1 and earlier,...

CVE-2008-0917

In the connected documents, CVE-2008-0917 is described as a cross-site scripting (XSS) vulnerability in multiple Tor World CGI scripts, including Tor Search 1.1 and earlier, I-Navigator 4.0, Mobile Frontier 2.1, Diary.cgi 1.5 and earlier, Tor News 1.21 and earlier, Simple BBS 1.3 and earlier, Int...

CVE-2008-0913

Invision Power Board (IPB/IP.Board) version 2.3.4 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via crafted BBCodes in an unspecified context. The issue is documented across multiple sources (e.g., NVD and Red Hat CVE) with...

CVE-2008-0917

Cross-site scripting XSS vulnerability in Tor World Tor Search 1.1 and earlier, I-Navigator 4.0, Mobile Frontier 2.1 and earlier, Diary.cgi aka Quotes of the Day 1.5 and earlier, Tor News 1.21 and earlier, Simple BBS 1.3 and earlier, Interactive BBS 1.3 and earlier, Tor Board 1.1 and earlier,...

CVE-2008-0913: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Invision Power Board IPB or IP.Board 2.3.4 allows remote attackers to inject arbitrary web script or HTML via crafted BBCodes in an unspecified context...

CVE-2008-0917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Tor World Tor Search 1.1 and earlier, I-Navigator 4.0, Mobile Frontier 2.1 and earlier, Diary.cgi aka Quotes of the Day 1.5 and earlier, Tor News 1.21 and earlier, Simple BBS 1.3 and earlier, Interactive BBS 1.3 and earlier, Tor Board 1.1 and earlier,...

Sql injection

SQL injection vulnerability in index.php in WoltLab Burning Board 3.0.3 PL 1 allows remote attackers to execute arbitrary SQL commands via the sortOrder parameter to the PMList page...

CVE-2008-0857

SQL injection vulnerability in index.php in WoltLab Burning Board 3.0.3 PL 1 allows remote attackers to execute arbitrary SQL commands via the sortOrder parameter to the PMList page...

JVN#54593414 Cross-site scripting vulnerability in multiple Tor World CGI scripts

Tor World provides CGI scripts for implementing search engines, message boards, and other tools. Multiple Tor World CGI scripts contain a cross-site scripting vulnerability. Impact An arbitrary script can be executed on the user's web browser. Solution Update the Software Apply the latest update...

Woltlab Burning Board 3.0.x Remote Blind SQL Injection Exploit

No description provided by source. ?php iniset"maxexecutiontime",0; echo "WoltLab Burning Board 3.0.X Remote SQL-Injection Exploit by NBBN\n"; start1, 48; / You have to edit this script. / / Works succesfully at 3.0.1. If you enter in 3.0.3 PL1:...

wbb-blindsql.txt

$char,BENCHMARK3000000,MD523,1"; // Edit 3000000 if the stuff doesn't work or taking long times. / Place here youre autologin cookie / $cookie = "wcfcookieHash=; wcfboardLastActivityTime=; wcfuserID=; wcfpassword=;"; $starttime = time; $connection = fsockopen$host, 80; fputs$connection, "GET:...

CVE-2008-0857: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in WoltLab Burning Board 3.0.3 PL 1 allows remote attackers to execute arbitrary SQL commands via the sortOrder parameter to the PMList page...

CVE-2008-0857

This entry covers CVE-2008-0857: a SQL injection in WoltLab Burning Board 3.0.3 PL 1’s index.php, exploitable through the sortOrder parameter on the PMList page. The underlying flaw is an injectable SQL command path in the application’s handling of that parameter, allowing remote attackers to imp...

CVE-2008-0857

SQL injection vulnerability in index.php in WoltLab Burning Board 3.0.3 PL 1 allows remote attackers to execute arbitrary SQL commands via the sortOrder parameter to the PMList page...

Woltlab Burning Board 3.0.x Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================== Woltlab Burning Board 3.0.x Remote Blind SQL Injection Exploit ============================================================== $char,BENCHMARK3000000,MD523,1"; // Edit 3000000 i...

Woltlab Burning Board 3.0.x - Blind SQL Injection

Woltlab Burning Board 3.0.x - Blind SQL Injection $char,BENCHMARK3000000,MD523,1"; // Edit 3000000 if the stuff doesn't work or taking long times. / Place here youre autologin cookie / $cookie = "wcfcookieHash=; wcfboardLastActivityTime=; wcfuserID=; wcfpassword=;"; $starttime = time; $connection...

woltlab303-sql.txt

WoltLab Burning Board 3.0.3 PL1 SQL Injection Vulnerability by NBBN Vendor: http://woltlab.de ::Proof of Concept http://site.tld/wbb3/index.php?page=PMList&folderID=0&pageNo=1&sortField=isViewed&sortOrder=ASC, SELECT password FROM wcf1user WHERE userID=1 AND...